medium5.4
CVE-2020-2283
Stored XSS vulnerability in Jenkins Liquibase Runner Plugin
Impact
Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin. Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:liquibase-runner | <= 1.4.5 | 1.4.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Liquibase Runner | through 1.4.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2020/09/23/1
- https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1885
- https://github.com/advisories/GHSA-9hg7-xmf8-jxf9
- https://nvd.nist.gov/vuln/detail/CVE-2020-2283
- https://github.com/jenkinsci/liquibase-runner-plugin/commit/4873c19dc921653d994edd6caa9e161c6353c6ae